securitytube

"""
This Challenge requires a 2 Step process:

1. Fetch the CSRF token from the JSON API defined below:

URL: /lab/webapp/csrf/13
Method: POST
Parameters: gettoken=true
Cookie: Required

securitytube

"""

Our embedded widgets are allowed to call our APIs from 3rd Party Websites. 

Here is an example API:

API Name: Challenge Verification API

API Endpoint:  /lab/webapp/csrf/12
METHOD:  PUT

securitytube

        param = self.request.get("ch10")
        referer = self.request.referer
        xreferer = self.request.headers.get('X-Referer')
        valid_referer = "http://pentesteracademylab.appspot.com/lab/webapp/csrf/10"

        if referer or xreferer:
            if param == flag and (referer == valid_referer or str(xreferer) == valid_referer) :
                cid = "success"
                self.response.headers.add_header("Set-Cookie", "cid-csrf10="+cid)
                self.redirect("/lab/webapp/csrf/10")

securitytube

        param = self.request.get("ch10")
        referer = self.request.referer
        xreferer = self.request.headers.get('X-Referer')
        domain = "pentesteracademylab.appspot.com"
        domain1 = domain2 = ''
        if referer:
            domain1 = referer.replace('http://', '').split('/')[0]

        if xreferer:
            domain2 = str(xreferer).replace('http://', '').split('/')[0]

securitytube

        param = self.request.get("ch9")
        referer = self.request.referer

        if referer:
            domain = referer.replace('http://', '').split('/')[0]
            logging.info(domain)
            if param == flag and ( domain.find("pentesteracademylab.appspot.com") != -1 ) :
                cid = "success"
                self.response.headers.add_header("Set-Cookie", "cid-csrf9="+cid)
                self.redirect("/lab/webapp/csrf/9")

securitytube

//   Dll Hijacking via Thread Creation 
// Author - Vivek Ramachandran 
//  Learn Pentesting Online --  http://PentesterAcademy.com/topics and http://SecurityTube-Training.com 
// Free Infosec Videos --  http://SecurityTube.net 



#include <windows.h>
#define SHELLCODELEN	2048

securitytube

#!/usr/bin/python

"""
 Author - Vivek Ramachandran 
 Learn Pentesting Online --  http://PentesterAcademy.com/topics and http://SecurityTube-Training.com 
 Free Infosec Videos --  http://SecurityTube.net 
"""

import sys, pefile

securitytube

#!/usr/bin/env python
# Author - Vivek Ramachandran
#
# Website - http://securitytube.net
#
# Python for Hackers: http://securitytube-training.com/online-courses/securitytube-python-scripting-expert/
#
# License: Use as you please for non-commercial purposes.
#

securitytube

#!/usr/bin/env python
# Author - Vivek Ramachandran
#
# Website - http://securitytube.net
#
# Python for Hackers: http://securitytube-training.com/online-courses/securitytube-python-scripting-expert/
#
# License: Use as you please for non-commercial purposes.
#

securitytube

#include<stdio.h>
#include<stdlib.h>
#include<sys/socket.h>
#include<features.h>
#include<linux/if_packet.h>
#include<linux/if_ether.h>
#include<errno.h>
#include<sys/ioctl.h>
#include<net/if.h>
#include<net/ethernet.h>